Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fixed masking passwords in a map used for logging in admingui + added warning to documentation #25144

Merged
merged 2 commits into from
Sep 14, 2024
Merged

Fixed masking passwords in a map used for logging in admingui + added warning to documentation #25144

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e39fe55
Minimalistic fix to avoid printing passwords into logs
dmatej Sep 13, 2024
9574760
Added warnings to documentation about sharing sensitive information i…
dmatej Sep 13, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions appserver/admingui/common/src/main/java/org/glassfish/admingui/common/util/RestUtil.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
/*
* Copyright (c) 2023 Contributors to the Eclipse Foundation
* Copyright (c) 2023, 2024 Contributors to the Eclipse Foundation
* Copyright (c) 2009, 2020 Oracle and/or its affiliates. All rights reserved.
*
* This program and the accompanying materials are made available under the
Expand Down Expand Up @@ -169,7 +169,7 @@ public static Map<String, Object> restRequest(String endpoint, Map<String, Objec
neutralizeForLog(GuiUtil.getCommonMessage("LOG_REST_REQUEST_INFO",
new Object[] {
endpoint,
(useData && "post".equals(method)) ? data : attrs, method
(useData && "post".equals(method)) ? data : maskedAttr, method
})));
}

Expand Down
16 changes: 16 additions & 0 deletions docs/administration-guide/src/main/asciidoc/logging.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,14 @@ we recommend to use the
or even better it's latest facade
`https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/System.Logger.html[System.Logger]`.

[WARNING]
====
Logs may contain sensitive information.
Despite the {productName} in default configuration doesn't log any passwords,
before you share logs with anyone else you should verify that you don't compromise your
system by any information contained in logs, especially if you configured more verbose log levels.
====

[[log-manager]]
==== Log Manager

Expand Down Expand Up @@ -871,6 +879,14 @@ You will probably need to set logger levels most often.
Let's imagine that you would need to set the most verbose logging of an application
using the `org.acme` package (and logger names).

[WARNING]
====
Logs may contain sensitive information.
Despite the {productName} in default configuration doesn't log any passwords,
before you share logs with anyone else you should verify that you don't compromise your
system by any information contained in logs, especially if you configured more verbose log levels.
====

Then you can edit the `logging.properties` file directly, what can be quite
more complicated it you use more than one instance, see the xref:configuring-warning[warning].

Expand Down
25 changes: 17 additions & 8 deletions docs/security-guide/src/main/asciidoc/running-in-secure-environment.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -427,16 +427,25 @@ attempted breaches. Noting repeated failed logon attempts or a
surprising pattern of security events can prevent serious problems.

|Set logging for security and SSL messages. a|
Consider setting module log levels for
table.jakarta.enterprise.system.ssl.security and
jakarta.enterprise.system.core.security. You can set a level from Severe
to Finest (the default is Info), but be aware that the finer logging
levels may produce a large log file.

By default, {productName} logging messages are recorded in the server
log, and you can set the file rotation limit, as described in
Consider setting module log levels for +
`jakarta.enterprise.system.security.ssl` +
and +
`jakarta.enterprise.system.core.security`. +
You can set a level from `SEVERE` to `FINEST` (the default is `INFO`),
but be aware that the finer logging levels may produce a large log file
and may contain sensitive information.

By default, {productName} logging messages are recorded in the `server.log` file,
and you can set the file rotation limit, as described in
xref:reference-manual.adoc#rotate-log[`rotate-log`(1)]

|Ensure that you don't share sensitive information in logs.
|Logs may contain sensitive information.
Despite the ${productName} in default configuration doesn't log any passwords,
before you share logs with anyone else you should verify that you don't compromise your
system by any information contained in logs, especially if you configured
more verbose log levels.

|Ensure that you have correctly assigned users to the correct groups.
|Make sure you have assigned the desired set of users to the right
groups. In particular, make sure that users assigned to the asadmin
Expand Down